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(54) Postage metering locking 
system 

(57) A postage metering lock-out 
security system is disclosed for use 
with electronic postage meters and 
for use with a postage metering 
system that operates in conjunction 
with a users computer 28 and printer 
30 that prints postal value. With the 
lock out security system, in order for 
postage to be printed, the postage- 
metering control unit 14 must receive 
a valid signal or password. The 
password may also be used to 
identify a particular user for 
accounting purposes. The metering 
system can also be provided with an 
internal clock so that metering may 
take place only within circumscribed 
times. An additional security feature 
is provided by an automatic call-back 
for postage recharging from a remote 
data centre 1 2 in order to assure that 
the meter is physically located at the 
appropriate location. 
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SPECIFICATION 

Postage metering locking system 

The invention relates to electronic postage 
5 meters and to electronic postage metering ac- 
counting units designed for operation in con- 
junction with a user's computer and printer. 
As used herein the term electronic postage 
meter also refers to other similar meters, such 

10 as parcel registers and tax meters, which dis- 
pense and account for vatue. 

Electronic postage meters are known and 
described for example in U.K. Patent No. 1 
492 704. Electronic postage meters which uti- 

15 lize the customer's computer and printer are 
described for example, in our copending U.K. 
Patent Application Nos. 8609189 and 
8609030. 

In postage meters, the need for security is 

20 absolute. The reason for the absolute security 
requirement is that a postage meter is printing 
value, and unless security measures are taken, 
one would be able to print unauthorized pos- 
tage, thereby defrauding the U.S. Postal Ser- 

25 vice. Most of the security measures taken are 
of a physical nature, but recently there have 
been suggestions for use of encryption to en- 
sure that a postage indicia is valid. 
In these meters, however, the security ef- 

30 forts have been directed mainly to preventing 
fraud on the Postal Service. There has been 
no consistent attempt to provide security for 
the customer who is authorized to use the 
postage meter to enable him to prevent unau- 

35 thorized access for the use of the postage 
meter except by use of a lock and key to turn 
on the meter. Typically anyone who has phy- 
sical access to the operating postage meter 
can meter postage for personal or unautho- 

40 rized use at the expense of the authorized 
customer who has paid for the postage. 

According to one aspect of this invention 
there is provided a postage metering system 
including security means operative to enable 

45 the metering of postage value only upon the 
occurrence of predetermined user-settable 
conditions. Preferably the security means com- 
prises timing means for enabling the metering 
of postage only during a predetermined time 

50 interval. Alternatively or additonally the secu- 
rity means may require a user-identifying sig- 
nal to enable the metering of postage. Prefera- 
bly the security means includes means for en- 
abling the metering of postage only upon the 

55 input of a user-identifying signal. The user- 
identifying signal may conveniently be a pas- 
sword. 

Preferably the system further comprises a 
control centre operative to provide postage 
60 meter recharging of postage funds by tele- 
phone communication and the security means 
allows recharging only by telephone connec- 
tion originating from the control centre. 
According to another aspect of the inven- 
65 tion there is provided a method for providing 



security for the operations of a postage meter 
comprising the steps of: 

(a) storing a user-identifying signal in a secu- 
rity module of a postage meter; 

70 (b) inputting an identifying signal to the pos- 
tage meter for enabling metering operations 
thereof; 

(c) comparing said identifying signal with 
said user-identifying signal; and 
75 (d) enabling postage metering operation if 
said identifying sifnal matches said user-iden- 
tifying signal. 

Preferably the above method further com- 
prises the steps of: 
80 (a) setting a start time limit and a stop time 
limit in the security module; and 

(b) providing the time of inputting of said 
identifying signal to said postage meter; 

(c) comparing the time of inputting to the 
85 start and stop time limits previously set and 

enabling the meter operation if the time is in 
the interval between the limits. 

Conveniently, said method further comprises 
the steps of: 
90 (a) storing a second user-identifying signal in 
said security module; 

(b) inputting an identifying signal to said 
postage meter; 

(c) comparing said identifying signal with 
95 said second user-identifying signal; and 

(d) enabling the setting of meter operating 
limits only when said identifying signal mat- 
ches said second-user-identifying signal. 

According to another aspect of this inven- 
100 tion there is provided a method for providing 
security for the operation of a postage meter 
comprising the steps of: 

{a) setting a start time and stop time limit in 
a security module of a postage meter; 
105 (b) inputting an identifying signal to the pos- 
tage meter; 

(c) providing a time signal in correspondence 
to the time of said inputting of the identifying 
signal; 

110 (d) comparing said time signal with time lim- 
its and enabling the meter if the time is in the 
interval between the limits. 

According to another aspect of this inven- 
tion there is provided a method for securing 
1 15 and recharging of funds to a postage meter 
comprising the steps of: 

(a) providing a user-identifying signal for en- 
abling access to a meter-funds recharging pro- 
gram in a postage meter; 
120 (b) inputting an identifying signal to the pos- 
tage meter; and 

(c) comparing said identifying signal with 
said user-identifying signal and if there is a 
. rpatch, enabling the meter funds recharging 
125 program. This method may further comprise 
the steps of: 

(a) initiating communication to a control 
centre for recharging funds said communi- 
cation providing meter information, including . 
130 the number for reestablishing communication 
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with the postage meter; 

(b) breaking the communications; and 

(c) initiating communication from the control 
centre to the postage meter in order to enable 

5 a funds transfer. 

Further features and advantages of the 
method and apparatus in accordance with the 
invention will become more apparent from the 
following description, which is by way of 
10 example only, reference being made to the 
accompanying drawings, in which:- 

Figure 1 shows a block diagram of a sys- 
tem which incorporates the instant invention, 

Figure 2 is a flow chart illustrating a method 
15 in accordance with the invention of enabling 
access to the electronic postage meter, 

Figures 3A and 3B comprise flow charts il- 
lustrating another method of enabling access; 
and 

20 Figure 4 is a flow chart illustrating the call 
back method of meter recharging in accor- 
dance with the invention. 

Referring generally to the system illustrated, 
in one embodiment, to alleviate the lack of 

25 security for the mail user, a security means is 
provided to lockout postage meter operation 
unless it is enabled by the use of a particular 
word or identifying signal and/or only during 
particular preselected time intervals to enable 

30 the customer to prevent unauthorized access 
to the electronic postage meter funds. In a 
further embodiment, the funding of the meter 
is enabled only upon the communication being 
initiated by a control centre in order to assure 

35 that funds transferred from the control centre 
are transferred at the behest of the actual 
authorized user of the meter at his physical 
location. For best results, only one person at 
a facility will be able to request the transfer of 

40 funds and to select the access words and 
times of use. 

Referring now to the Figures, in Fig. 1 , a 
postage and mailing information applying sys- 
tem which may practice the present invention 

45 is shown generally at 10 and includes a con- 
trol centre 12 and an accounting unit 14 that 
are in communication with one another 
through a communicating device such as a 
telephone 16, facsimile machine, telex ma- 

50 chine, or the like. 

Located within the accounting unit 14 is a 
modem 18 or converter 18 which communi- 
cates with the telephone 1 6 and a control 
module 20 of the accounting unit, which con- 

55 trol module may be a CPU processor such as 
an Intel 8081, available from Intel, Santa 
Clara, California, operating under a suitable 
control program. The control module includes 
a ROM 19 either integral or in connection 

60 therewith (as shown) in which the control pro- 
gram resides. In communication with the con- 
trol module 20 is an encryption module 22 as 
will as an accounting module 24. A suitable 
encryption module is described in U.K. Patent 

65 Application No. 8609030. The accounting mo- 



dule 24 includes a random access memory 
that incorporates the ascending and descend- 
ing registers. The RAM may be of the CMOS 
type including a battery-backup so that the 

70 register data may be retained or the account- 
ing module may incorporate a non volatile 
memory for permanent memory and further 
control to enable transfer of accounting data 
to permanent memory registers as is well 

75 known in the art. 

As is known in postage meters, the ascend- 
ing register is the register that records the 
amount of postage that is dispensed or 
printed on each transaction and the descend- 

80 ing register is that which records the value or 
amount of postage that may be dispensed and 
decreases from that amount as postage is 
printed. Another modem 26 within the ac- 
counting unit 14 provides communication be- 

85 tween the control module 20 and a user com- 
puter 28. It will be appreciated that such mo- 
dem 20 may be replaced by direct communi- 
cation between the computer 28 and the ac- 
counting unit 14 through parallel or serial inpu- 

90 t/output buffers or the like. It will be further 
understood that the modem 18 is optional 
and communication may be established 
through the user computer or by physically 
carrying the accounting unit 14 to the control 

95 center 12. 

The user computer may be any type of 
computer that has input/output, logic, and 
memory as, for example, a personal computer 
such as the IBM AT available from IBM, Ar- 

100 monk. New York. Connected to the user com- 
puter 28 is a printer 30. The printer may be 
of any type that is capable of printing indivi- 
dual alpha numerics and bar code. 
While this embodiment of the invention is 

105 described with respect to the foregoing illus- 
trated system, it will be understood that the 
invention may also be incorporated in a con- 
ventional electronic postage meter having an 
integral printer. 

110 In the block diagram shown in Fig. 1, the 
control center 1 2, which may be a Post Office 
or other data center such as employed in re- 
mote meter recharging operations as taught, 
for instance, in U.K. Patent Nos. 1 520 529 

115 and 1 520 530 incorporated herein by refer- 
ence, is a source of postage value. The pos- 
tage meter may be charged remotely upon a 
customer number being provided to the Postal 
Service. The Postal Service or data center, in 

120 turn, will provide postage value that is auto- 
matically input to the customer's postage 
meter, or in this case the accounting unit 14. 
In the system of Fig. 1, the accounting unit 
14 is a secure unit such that tampering by 

125 physical, electronic or magnetic means in inhi- 
bited. Security features such as shielding, 
break-away bolts and the like are well known 
and the means for securing the accounting 
unit will not be described. 

130 As detailed below in accordance with the 
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Invention the accounting unit 14 is accessible 
by the user computer only upon a proper 
code or password being received by the con- 
trol module 20 of this accounting unit 14 from 

6 the user computer 28. As brought out in the 
copending application No. 8609030., previ- 
ously referenced, postage to be printed by the 
printer 30 includes an encrypted string that is 
generated by the encryption module 22. Such 

10 encryption may be based upon any recognized 
code such as DES or ftSA. Upon the appropri- 
ate information being supplied to the account- 
ing unit 14 the encryption module 22 would 
generate an encrypted string to be printed 

15 upon a label or. mailpiece. This supplied infor- 
mation could include a transaction number, the 
customer, the value of postage and the like. It 
will be appreciated that in conventional elec- 
tronic postage meters, there is no encryption 

20 module. 

In accordance with this embodiment of the 
invention, a security module 32 which conve- 
niently may be conventional EPROM having a 
program residing therein accessed by the mi- 

25 coprocessor of the control module 20 is pro- 
vided to allow the owner and authorized users 
to enable the printing of postage and to pre- 
vent all others from fraudulent use of the 
meter portion 14. It will be understood that 

30 the security module may, of course, reside as 
an integral part of the control module 20, the 
encryption module 22, or the ACC module 24. 
It will be further appreciated that the security 
program module may suitably be a resident 

35 part of the microprocessor control program of 
a conventional electronic postage meter which 
is accessed by the microprocessor. It is fur- 
ther contemplated that the security module 32 
may have its own microprocessor operation 

40 for communicating in known manner with the 
control module 20. 

Referring now to Fig. 2, there is shown a 
flow chart of a way of implementing autho- 
rized-user-only access to the meter. The term 

45 user as defined herein is a customer of one 
designated by the customer, i.e. someone 
other than a service person, meter manufac- 
turer, or data center representative. As illus- 
trated in the flow chart, in order to enable the 

50 printing of postage a user identifying signal is 
provided. The user keys in a user-generated 
password from computer 28 through modem 
26 (or from the keyboard of the electronic 
postage meter) which password is compared 

55 with a word previously stored in the security 
module. If there is a match, the program re- 
turns control to the control module to con- 
tinue metering operation. If there is no match, 
the program will not enable the encryption 

60 module and will inform the user's computer 
via the modem 26 that an invalid code has 
been entered. In a conventional electronic pos- 
tage meter, the integral printer may be inhi- 
bited from imprinting the indicia. It will be un- 

65 derstood that the user's password may be 



communicated to the security module by 
means of a magnetic tape reader, card reader, 
or bar code reader instead of the user's key- 
ing the password through the keyboard. It will 

70 be appreciated that more than one password 
could be required if desired and that the us- 
er's password could be encrypted as part of 
the encrypted string to enable the particular 
user to be identified. The user's password will 

75 also enable the computer and/or meter portion 
to keep track of a particular user's postage 
usage for accounting purposes. 

As shown in the flow charts of Figs. 3A 
and 3B, the authorized meter user may also 

80 set time-of-day limits on the use of the meter 
to prevent, for example, after work-hours ac- 
cess to the meter. Preferably, a user-identify- 
ing password known only to one person de- 
scribed herein as the System Manager will en- 

85 able access to the time limit selection program 
shown in the flow chart of Fig. 3a. It will be 
appreciated that while less desirable from a 
security standpoint, if desired, any user may 
be given the system manager password to 

90 allow the user to change the preset time lim- 
its. It will be understood that the System 
manager is not limited to simply setting the 
time limits. It is also contemplated that the 
System Manager's access password may en- 

95 compass further user setting functions such as 
setting of fund authorization limits for a given 
user password, for example, or for setting the 
time limits for the use of a particular user 
identifying password to enable better user 

100 control and accounting for the printing of pos- 
tage or for changing the user's password. 

The flow chart of Fig. 3A is essentially self- 
explanatory. The system manager enters his 
identifying password (code) to enter the set- 

105 ting program. The start and stop time limits 
are inserted and the program returns to the 
normal operation operation program. Other 
limits may be accessed and set in a similar 
manner to that shown in Fig. 3A for the time 

1 10 limits. 

As shown in Fig. 3B, another user logs 
onto the meter by inputting his password as 
described with respect to Fig. 2. The program 
then compares the time of day which is ob- 

115 tained from internal clock 21 shown in Fig. 1 
with the preselected limits stored in the secu- 
rity module to determine whether the meter 
access is within the appropriate time limits. If 
it is the meter program control proceeds to 

120 normal operation. Thus meter operation is en- 
abled only at times between the preset limits. 

The flow chart of Fig. 4 shows a further 
security feature in recharging the funds of the 
meter. The authorized user, again preferably 

1 25 only one individual, the System Manager who 
has knowledge of the appropiate password to 
gain access to the funds transfer program, ini- 
tiates a transfer funds request. In accordance 
with the invention, once entered the meter or 

130 accounting unit 14 initiates a phone call to the 
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control center 12 through the device 16. The 
control center is then furnished with any de- 
sired meter identifying information including 
the meter's current telephone number. The 
5 communication connection is then broken. 
The control center 12 then initiates a com- 
munication to the accounting unit 14, verifies 
the request and phone number of the meter. 
The information is compared with that stored 

10 in the security module to determine whether 
the request is a valid request. If the request is 
deterimined to be a valid request then the 
fund transfer operation is performed in con- 
ventional manner as described, for instance, in 

15 U.K. Patent Nos. 1 520 529 and 1 520 530. 
If the request is determined to be invalid, 
the control center 12 receives a signal indica- 
tive that there was an unauthorized request 
for funds transfer and the unauthorized call is 

20 reported. 

CLAIMS 

1. A postage metering system including 
security means operative to enable the meter- 

25 ing of postage value only upon the occurrence 
of predetermined user-settable conditions. 

2. A system according to claim 1 wherein 
the security means comprises timing means 
for enabling the metering of postage only dur- 

30 ing a predetermined time interval. 

3. A system according to claim 1 or claim 
2 wherein the security means requires a user- 
identifying signal to enable the metering of 
postage. 

35 4. A system according to claim 1 or claim 
2 wherein the security means includes means 
for enabling the metering of postage only 
upon the input of a user-identifying signal. 

5. A system according to claim 3 or claim 
40 4 wherein the user-identifying signal is a pas- 
sword. 

6. A system according to any of the pre- 
ceding claims wherein the system further com- 
prises a control centre operative to provide 

45 postage meter recharging of postage funds by 
telephone communication and wherein the se- 
curity means allows recharging only by tele- 
phone connection originating from the control 
centre. 

50 7. A method for providing security for the 
operations of a postage meter comprising the 
steps of: 

(a) storing a user-identifying in a security 
module of a postage meter; 
55 (b) inputting an identifying signal to the pos- 
tage meter for enabling metering operations 
thereof; 

(c) comparing said identifying signal with 
said user-identifying signal; and 
60 (d) enabling postage metering operation if 
said identifying signal matches said user-iden- 
tifying signal. 

8. A method according to claim 7 and fur- 
ther comprising the steps of: 
65 (a) setting a start time limit and a stop time 



limit in the security module; and 

(b) providing the time of inputting of said 
identifying signal to said postage meter; 

(c) comparing the time of inputting to the 
70 start and stop time limits previously set and 

enabling the meter operation if the time is in 
the interval between the limits. 

9. A method according to claim 7 or claim 
8, further comprising the steps of: 

75 (a) storing a second user-identifying signal in 
said security module; 

(b) inputting an identifying signal to said 
postage meter; 

(c) comparing said identifying signal with 
80 said second user-identifying signal; and 

(d) enabling the setting of meter operating 
limits only when said identifying signal mat- 
ches said second-user-identifying signal. 

10. A method for providing security for the 
85 operation of a postage meter comprising the 

steps of: 

(a) setting a start time and stop time limit in 
a security module of a postage meter; 

(b) inputting an identifying signal to the pos- 
90 tage meter; 

(c) providing a time signal in correspondence 
to the time of said inputting of the identifying 
signal; 

(d) comparing said time signal with time lim- 
95 its and enabling the meter if the time is in the 

interval between the limits. 

11. A method for securing and recharging 
of funds to a postage meter comprising the 
steps of: 

100 (a) providing a user-identifying signal for en- 
abling access to a meter-funds recharging pro- 
gram in a postage meter; 

(b) inputting an identifying signal to the pos- 
tage meter; and 

105 (c) comparing said identifying signal with 
said user-identifying signal and if there is a 
match, enabling the meter funds recharging 
program. 

12. A method according to claim 11 and 
1 10 further comprising the steps of: 

(a) initiating communication to a control 
centre for recharging funds said communi- 
cation providing meter information, including 
the number for reestablishing communication 

1 1 5 with the postage meter; 

(b) breaking the communications; and 

(c) initiating communication from the control 
centre to the postage meter in order to enable 
a funds transfer. 

120 13. A postage metering system substan- 
tially as hereinbefore described with reference 
to and as illustrated in, any of the accompany- 
ing drawings. 

14. A method of providing security for the 
125 operation of a postage meter substantially as 

hereinbefore described with reference to, and 
as illustrated in, any of the accompanying 
drawings. 

15. A method for securing the recharging 
130 of funds to a postage meter substantially as 
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hereinbefore described with reference to, and 
as illustrated in, any of the accompanying 
drawings. 

16. Any and all novel features of the sys- 
5 tern described herein. 
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